Atlassian patches critical arbitrary file access vulnerability CVE-2026-21589 across products

Atlassian published a security advisory on October 5, 2026, for CVE-2026-21589, a critical arbitrary file access vulnerability affecting eight self-managed products. Rapid7 and SOC Prime reported that the flaw carries a CVSSv4 score of 9.3 and allows unauthenticated attackers to read sensitive files. [1][2][4][7]

The security flaw affects Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Help Net Security reported that active exploitation attempts against the flaw began shortly after technical information became public. [1][3][6][7]

As FTMQ Security reported earlier, hackers began targeting vulnerable systems after watchTowr researchers published technical details regarding the flaw. Security honeypots detected exploitation activity soon after the research was disclosed online. [3][7]

Atlassian has released updates to address the issue across all affected Data Center products. Security administrators are advised to apply the official patches immediately to protect vulnerable deployments from unauthorized access. [1][6][7]